Pandora: Documentation en: Satellite

From Pandora FMS Wiki
Revision as of 16:28, 20 June 2014 by Ivo yordanov (talk | contribs) (Created page with '= Satellite Server = == Introduction == The Satellite Server is used for network and remote systems monitoring and discovery. It can discover network elements (routers, switche…')
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

1 Satellite Server

1.1 Introduction

The Satellite Server is used for network and remote systems monitoring and discovery. It can discover network elements (routers, switches, etc) using SNMP or ICMP, or Windows (using WMI) or Linux (using SNMP) servers. This is no ordinary server, it can be considered to be a broker agent with extended functions. It is an exclusive component for the Enterprise version. It is especially useful to monitor inaccessible, by the Pandora Server, remote networks, where a software agent just isn't and option.


Satelite detailed.png

This server doesn't require a connection with the pandora database. It sends all information in XML format using the tentacle protocol like and agent.

The satellite server can be used in Windows and Linux alike although the installation process in both cases is a little different.

This server has some characteristics witch make it unique and more than recommended on many occasions:

  • It can execute network tests (ICMP, Latency and SNMP v1 and v2) at an extremely high pace (500 checks per second).
  • It only sends information to the server after some period of time (300 seconds by default), but it can execute the latency, ICMP and SNMP tests within a smaller interval (30 seconds for example). This way it can notify the Pandora Server almost instantly when a change in the status is detected. This status changes must be previosly defined if the module type isn't a generic_proc type (network interfaces or general network connectivity for example)
  • It doesn't require connection to the database. It sends all files in XML format the same way as an independent server, similar in many ways to a broker agent or an export server.
  • It has an autodiscovey mechanism for SNMP and WMI. Once an agent is detected (by IP address), it detects the dynamic elements (network interfaces, storage) and monitors them automatically.
  • In Windows systems it can detect the discdrive, CPU, and memory.
  • In systems with SNMP it can detect the status of the interfaces, inbound and outbound traffic for each interface and the name of the system.
  • The autogenarated modules can be modified, like every other module, administrating the agent from the console like any other agent in the massive operations menu and for these modules from the Satellite section.
  • Agents can be created directly by the creation o an agent configuration file in the satellite server directory for agent configuration files.

1.2 Installation

The Satellite Server is distributed in binary format this way no additional library is required. In both Windows and Linux versions the functionality of this server is the same. In Windows systems it is installed as a service and in Linux systems it is installed as a daemon. The configuration file and specifications in both cases are the same.

1.3 Satellite Server Installation in Linux Systems

Once downloaded the binary witch contains the satellite server we must go to the download directory with root privileges and extract the files from the binary:



Desarchivar.png



The a satellite_server will be created. We must enter that folder typing:

cd satellite_server/

Before proceeding with installation it is necessary to clarify that nmap, wmic and braa are absolutely necessary for the Satellite Server:

The Satellite Server only functions with the following nmap versions: 5.51-1; 6.00; 6.01; 6.25; 6.40

The 6.46 version of nmap isn't compatible with the Satellite Server.

In the installer the Braa and Wmic packages are included. NMAP must be installed independently. To download NMAP you can visit the oficial NMAP website: http://nmap.org/

To install the Satellite Server we can just follow the instructions in the following image:



Instalacion linux.png



Once finished we need to edit the satellite_server.conf file, located in /etc/pandora/ To start the Satellite Server we need to type the following:

sudo /etc/init.d/satellite_serverd start

In case of an error take a look at the satellite_server.log file, located in /var/log/

1.4 Windows Installation

The Satellite Server can be installed following these simple steps:

We start by chosing the installation language:



English installation1.png


Then we click on Next



English installation2.png



Then we choose where to install the Satellite Server:



English installation3.png



Installation of WinPCap is required. The WinPCap installation window would appear at this step of the installation process:



Instalación wincap1.png


Then we must configure WinPCap to start on when system starts.



Instalación wincap2.png



Once finished the installation of WinPCap we would see the following window:



Instalación wincap3.png


The the license number must be introduced:



English installation4.png


Then the parameters of the recon task must be configured:



English installation5.png


At the end a restart of the system is required for all changes to take place.



English installation6.png


Once finished the Satellite Server can be started from the start menu.

1.5 Configuration

All parameters that require a timeout or some time are specified in seconds, for example 300 = 5 minutes.

It is important to keep in mind that the latency and snmp intervals are specific for the status change. In case of Boolean checks (port or machine status) the threshold witch defines the change of state is automatic. For the numerical values (latency, network traffic in an interface, disk space, CPU, etc) it is based in a threshold that must be defined in each module.

1.5.1 agent_interval xxx

300 seconds by default (5 minutes), it creates agents with an interval of 5 minutes. Information ins't send to the server till this time has passed. Independently that the checks done by the network server have a lower interval.

1.5.2 xxxxxx_interval xxx

Executes all checks (latency, snmp, etc) with some interval. If the current information is different compared with the previous one it sends it instantly. If it is the same it will send it when the agent interval has passed. It is useful to do intesive checks and notify only in case of a status change.

1.5.3 xxxxx_retries xxx

Number of retries in checks (latency, snmp, ping...)

1.5.4 xxxxx_timeout xxx

Timeout in seconds for the SNMP, Latency and Ping checks.

1.5.5 xxxxx_block xxx

Forces the server to execute the checks in blocks of XXX checks. The higher the number (500 tops) the more capacity it would have, but with an increased latency. In some cases it mind be recommended to lower this number (latency, ping and snmp)

1.5.6 xxxxx_threads n

Number of assigned threads to every type of check. It depends on the capacity (CPY and Memory) of the machine. The higher the threads more pressure would be put on the machine but the processing speed would be higher for the satellite server.

1.5.7 log_file /dev/null

Satellite server logfile. It can grow quickly, so it is recommended, if not going to be used, to be redirected to /dev/null/. It is usefull at the beginning to try and discover possible errors and later on comment it.

1.5.8 recon_task xxxxx[,yyyy]

IP Address and network addresses for autodiscovery for example:

192.168.50.0/24,10.0.1.0/22,192.168.70.64/26

1.5.9 server_ip <ip>

Pandora FMS Server ip address where the information is send using the tentacle protocol (port 41121/tcp)

1.5.10 recon_mode [icmp,snmp,wmi]

Autodiscovery mode. The system would use the following protocols to in recon checks:

  • ICMP: It would just check if the host is alive and the latency time.
  • SNMP: If capable it would look for all the interfaces and get it's trafic, general status etc..

It can only use v1 and 2 of SNMP.

  • WMI: Similar to the previous but in this case it would show: CPU Usage, Memory and Diskdrives

1.5.11 recon_community aaa,bbb,ccc...

States a list of SNMP communities to be used in autodiscovery mode.

1.5.12 wmi_auth Administrator%password

Specifies a list of groups of User%Password, f.e: admin%1234,super%qwerty. This list is used in autodiscovery mode.

1.5.13 agent_conf_dir <path to agente conf dir>

In this directory the config files are automatically of each agent discovered by the satellite server is stored.

1.5.14 group <grupo>

Specifies the default group for the agents created by the Satellite Server.

1.5.15 daemon 1|0

When set to 1 starts the daemon in the background (by default).

1.5.16 hostfile <file>

It is an alternative method for network scanning. A file is provided with an adress in each line. It can include the hostname as well.

1.5.17 pandora_license xxxxxxx

Here you must input the license number of your Pandora FMS server the same way it appears in the Setup->Licency section. The total number of agents is verified in the pandora console.

1.5.18 remote_config 1|0

Specifies if the autodiscovery agents have enabled remote config to edit them from the console.

1.6 Specific Configurations (per agent)

In addition to autodiscovered modules, all kinds of TCP, SNMP or WMI tests can be added, using a similar syntax to the local modules in software agents.

Status of the Interface (SNMP). The Satellite Server detects automatically each interface.

module_begin
module_name if eth1 OperStatus
module_description IP address N/A. Description: The current operational state of the interface. The testing(3) state indicates that no operational packets can be passed.
module_type remote_snmp_string
module_snmp 192.168.70.225
module_oid .1.3.6.1.2.1.2.2.1.8.3
module_community artica06
module_end

Conectivity to a machine (using PING)

module_begin
module_name ping
module_type generic_data
module_ping 192.168.70.225
module_end

General SNMP check. In this case the server extracts automatically the traffic for each interface with it's descriptive name.

module_name if eth0 OutOctets
module_description The total number of octets transmitted out of the interface, including framing characters.
module_type remote_snmp_inc
module_snmp 192.168.70.225
module_oid .1.3.6.1.2.1.2.2.1.16.2
module_community artica06
module_end

CPU WMI usage check(percentage).

module_begin
module_name CPU
module_type generic_data
module_wmicpu 192.168.30.3
module_wmiauth admin%none
module_end

Memory free wmi check(percentage).

module_begin
module_name FreeMemory
module_type generic_data
module_wmimem 192.168.30.3
module_wmiauth admin%none
module_end

General WMI Querry

module_begin
module_name GenericWMI
module_type generic_data
module_wmiquery 192.168.30.3
module_wmiauth admin%none
module_end


To introduce a threshold we must do it in the text definition of the module and the definition in the console for each module (module_min_warning, module_min_critical):

module_begin
module_name latency
module_type generic_data
module_latency 192.168.70.225
module_min_warning 80
module_min_critical 120
module_end

Manually we can create execution modules. The scripts or commands that the satellite server executes must be previously established and available for the server to use. The use of module_exec can make the performance speed of the satellite server to shrink.

module_begin
module_name Sample_Remote_Exec
module_type generic_data
module_exec /usr/share/test/test.sh 192.168.50.20
module_min_warning 90
module_min_critical 95
module_end


1.7 General view of all agents in the console

If the configuration of the satellite server is correct we should be able to see the following in Agent Detail:



Selección 146.png


Generally in all machines ICMP (Ping and Latency) modules would be created but in some machines SNMP and WMI modules can be created.

In machines witch have enabled WMI the following modules can generate.



Modulos.png


In machines with enabled SNMP the following modules will generate:



Modulos1.png


In the massive operations menu of the pandora console there is a specific section for the satellite server where different edition, deletion actions can be performed on agents and modules massively.



Operación massivas.png